GHSA-hr68-hvgv-xxqf

Hashicorp Nomad Incorrect Privilege Assignment vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-12678

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/nomad	< 1.9.4	1.9.4

Details

As written in the advisory (Markdown source, shown as plain text).

Nomad Community and Nomad Enterprise ("Nomad") allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, and 1.7.16.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-12678 advisory
https://github.com/hashicorp/nomad/commit/359a71861ef044cb5d749a36ff0e44b172c8f1a6 web
https://discuss.hashicorp.com/t/hcsec-2024-29-nomad-allocations-vulnerable-to-privilege-escalation-within-a-namespace-using-unredacted-workl… web
https://github.com/hashicorp/nomad package